NTP BUG 3118: Mode 6 unauthenticated trap information disclosure and DDoS vector

Last update: November 3, 2025 16:09 UTC (9cbb45cb6)

Summary

Resolved	4.2.8p9	21 Nov 2016
References	Bug 3118	CVE-2016-9310
Affects	ntp-4.0.90 (21 July 1999), possibly earlier, up to but not including ntp-4.2.8p9, and ntp-4.3.0 up to, but not including ntp-4.3.94.	Resolved in 4.2.8p9
CVSS2 Score	MED 6.4	AV:A/AC:L/Au:N/C:N/I:N/A:P
CVSS3 Score	MED 6.5	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

An exploitable configuration modification vulnerability exists in the control mode (mode 6) functionality of ntpd. If, against long-standing BCP recommendations, restrict default noquery ... is not specified, a specially crafted control mode packet can set ntpd traps, providing information disclosure and DDoS amplification, and unset ntpd traps, disabling legitimate monitoring. A remote, unauthenticated, network attacker can trigger this vulnerability.

Mitigation

Implement BCP-38.
Use restrict default noquery ... in your ntp.conf file.
Upgrade to 4.2.8p9 or later.
Properly monitor your ntpd instances, and auto-restart ntpd (without -g) if it stops running.

Credit

This weakness was discovered by Matthew Van Gundy of Cisco.

Timeline

2016 Nov 21: Public release
2016 Nov 15: CERT given our software release notification
2016 Nov 14: Early Access Program Release: Premier and Partner Institutional Members
: Notification to Institutional Members
: Report received